asterisk - security update

Fixed packages 1

Vulnerabilities 8

• Critical 9.8
  CVE-2022-31031

  Potential stack buffer overflow when parsing message as a STUN client

  PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJ…

  pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  Jun 7, 2022
• Critical 9.1
  CVE-2022-39269

  Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip

  PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vul…

  pjsip pjproject asterisk asterisk Debian Ubuntu Alpine
  Oct 6, 2022
• High 7.5
  CVE-2022-37325

  In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message …

  asterisk asterisk asterisk Debian Ubuntu Alpine
  Dec 5, 2022
• High 7.5
  CVE-2022-39244

  Buffer overflow in pjlib scanner and pjmedia

  PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clien…

  pjsip pjproject asterisk asterisk Debian Ubuntu Alpine
  Oct 6, 2022
• Medium 6.5
  CVE-2022-23537

  PJSIP vulnerable to heap buffer overflow when decoding STUN message

  PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown att…

  pjsip pjproject asterisk asterisk Debian Ubuntu Alpine
  Dec 20, 2022
• Medium 6.5
  CVE-2022-23547

  Heap buffer overflow in pjproject when decoding STUN message

  PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a cert…

  pjsip pjproject asterisk pjproject Debian Ubuntu
  Dec 23, 2022
• Medium 6.5
  CVE-2022-42705

  A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a rem…

  asterisk asterisk asterisk Debian Ubuntu Alpine
  Dec 5, 2022
• Medium 4.9
  CVE-2022-42706

  An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified thro…

  asterisk asterisk asterisk Debian Ubuntu Alpine
  Dec 5, 2022